Questions tagged [rpz]

Response Policy Zones are a form of DNS firewall that define policy actions within a DNS zone file.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

Sometimes, the Bind9 will return the recursive record after I configure the response policy zone

I configure a response policy zone in my DNS server and I use that to block two domains. This is my zone file. $TTL 1 $ORIGIN rpztest. @ IN SOA ns1.fati. ns2.fati. ( ...
北山硝子's user avatar
0 votes
0 answers
233 views

Bind9 how to use RPZ zone for specific subnets

I already have 1 master(192.168.130.32) 4 slaves(192.168.130.35) and 2 authoritative(192.168.130.33) servers with bind9. My point is to get RPZ(192.168.130.37) from external DNS servers, but I want to ...
robotiaga's user avatar
  • 101
-2 votes
2 answers
494 views

Block IP in DNS Zone File (Instead of Domain)

I'm using bind9 DNS server. I used to block websites using their domain name in RPZ zone file such as: malicious.example CNAME . But, I need to block IP rather than domain such as: 192.0.2.4 ...
Saga Harby's user avatar
0 votes
2 answers
567 views

How to set up whitelisting on a DNS forwarding server with BIND9?

I have set up a DNS forwarding server on Ubuntu 20.04 LTS using Bind 9. I need to implement DNS whitelisting, however, I have not found any tutorials which explain how to set it up. I have tried ...
jefazo92's user avatar
0 votes
2 answers
1k views

Bind9 Response Policy ignoring out-of-zone data

I'm trying to set up response policy on my existing Bind9 server because I'd like to override some of my company public domain to redirect them to our private network ips. I've followed this tutorial :...
Ror's user avatar
  • 333
0 votes
1 answer
706 views

Overriding a .local Domain to a Public IP

I am using a BIND9 DNS server for my org, and I have an application that was published with a .local domain: example.website.local. There is an .com alternative that I want to re-map the .local to ...
TrivPants's user avatar
1 vote
0 answers
291 views

Is there a way to block a specific query type on bind

I've been trying to find a way to block the WKS query type from our bind servers. We have found that is is extensively used by tunneling software. I tried using RPZ but i'm not sure on how to block a ...
Georgios Vasilakis's user avatar
3 votes
0 answers
326 views

How to block AAAA answers for certain domains using RPZ?

Is it possible to block AAAA answers being sent back to clients from a local dns server, but only for certain forward dns domains? I know I can do the filtering based on ipv6 subnet (working sample ...
vobelic's user avatar
  • 323
1 vote
0 answers
624 views

Why does BIND perform a double query before answering NXDOMAIN for a RPZ (response-policy zone)?

The goal is to have a local DNS server with the following specifics: split DNS setup that resolves a FQDN (e.g. localdomain.com) to a local IP instead of the external IP use a RPZ (response policy ...
thomas1985's user avatar
0 votes
1 answer
1k views

Log category RPZ to syslog in BIND 9

I am running a chrooted BIND 9.11 server on FreeBSD 11.2 that has a RPZ configured. It is currently logging RPZ hits in a file, but I would like to (also) send them to syslog. I can see other log ...
scherand's user avatar
  • 179
0 votes
1 answer
1k views

Wildcards in RPZ (response policy zones)

Is it possible to have wildcards domains in the middle of a domain name using response policy zones? For example s3.*.amazonaws.com. If this is not possible, is there a technology, that can do this?
stena's user avatar
  • 101
2 votes
2 answers
3k views

'query_getzonedb()failed: Zone Not Loaded' error in DNS logs

While investigating an incident, I noticed an error in my syslog that looks like this (anonymized): Feb 3 21:59:59 ns1 named[18824]: client xxx.xxx.xxx.xxx#2091 (us-east1-aws.api.snapchat.com): view ...
Watki02's user avatar
  • 617
0 votes
2 answers
736 views

Get DNS 'Additional section' using Windows (nslookup option?)

I can use dig to get the full master file output of DNS info, and for my problem I am interested in the information in the "additional" section: $ dig example.com ; <<>> DiG 9.9.4-RedHat-...
Watki02's user avatar
  • 617
1 vote
0 answers
429 views

Why does my Bind RPZ config work for one host, but not the other (SERVFAIL)

I have some hosts in a DMZ which need to use LDAP resources on the LAN. We don't forward DNS into the LAN, so instead of adding entries in individual /etc/hosts, I decided to try a Bind RPZ zone to ...
Server Fault's user avatar
  • 3,774
3 votes
1 answer
1k views

RPZ CNAME leaks usage of RPZ

For history reasons we have both internal (192.168.0.0/16) and public IPs on hosts on one domain (example.com). I now want to split this up so that internal hostnames are not resolved for external ...
Clemens Bergmann's user avatar
2 votes
0 answers
506 views

BIND different forwarder based on response ip (rpz-ip)

I have a recursive BIND dns server . forwarders { 8.8.8.8; }; Is it possible to change the forwarder based on respone ip ? For example if the response is 192.168.1.1 then forward/...
Omid Kosari's user avatar
7 votes
1 answer
5k views

BIND, RPZ and Forwarding priorities

My objective is to block certain domains in bind WITHOUT first looking up their address (this is a small caching bind dns server). Currently my configuration will forward the request for badhost.com ...
Jon T's user avatar
  • 73
1 vote
1 answer
1k views

serve the root zone with bind and utilize RPZ

I have some problems with configuring BIND as my private server at root zone. I have tried the dot "." (had read somewhere) and an empty string "" (my bad guess) as for the root zone identifier (...
F.I.V's user avatar
  • 139
4 votes
1 answer
1k views

Alternative ways to get past 32 rpz zone limit in BIND? ...without running BIND a thousand times

Using BIND RPZs gives me exactly what I'm looking for to alter queries. However, my recursive DNS server is in use by hundreds of clients and I am looking for a way to allow each client some level of ...
user avatar
0 votes
2 answers
10k views

With BIND 9 how can I match-clients in multiple views?

BIND appears to be looking at the configuration file from top-down and assigning queries to the first matching view based on match-clients. According to http://www.zytrax.com/books/dns/ch7/view.html ...
user avatar
1 vote
1 answer
1k views

Certificate Errors on "redirection" in DNS RPZ of https/ssl

I've set up a DNS RPZ where I "redirect" users to a walled garden using DNS RPZ records when users try to access a list of bad sites. Let's say a user tries to access badsite.com. The redirection to ...
thelok's user avatar
  • 13
7 votes
1 answer
8k views

Set up BIND9 as DNS Firewall

With OpenDNS now needing one to be on the pro package to have filtering turned on, being on a tight budget, we are in need of free DNS filtering. After reading this link on how to block domains with ...
belteshazzar's user avatar
0 votes
1 answer
2k views

Why does nslookup not return what I am expecting from my bind server? (RPZ configured)

Prior to this question I was looking for some help in finding a way to return a different response to querying clients based on their IP Address. The question was answered here: How can I selectively ...
Kladskull's user avatar
  • 1,275
2 votes
2 answers
269 views

Can DNS RPZ firewalls protect against IP Access?

I am looking into DNS-RPZ firewalls. Can they protect against users browsing to http://{ip-address}? If so how does that work? Given no name resolution is required?
Adam Mills's user avatar
2 votes
1 answer
385 views

How to automatically rewrite response records obtained using recursion in BIND?

I'm using Bind 9.9.4 on a hypervisor (lets call the hypervisor A) for VMs. The hypervisor has a VPN connection to a different host (lets call it B), which also has a public IP. The bind on hypervisor ...
Jonas Schäfer's user avatar